From b6f73bc82a67d1bde9c69dc000d10d7c72a51350 Mon Sep 17 00:00:00 2001 From: Maysa Macedo Date: Wed, 15 May 2019 11:48:44 -0400 Subject: [PATCH] Increase coverage for e2e Network Policy tests --- test/e2e/network/network_policy.go | 179 +++++++++++++++++++++++++++++ 1 file changed, 179 insertions(+) diff --git a/test/e2e/network/network_policy.go b/test/e2e/network/network_policy.go index 6db4cd155a..6917dd7260 100644 --- a/test/e2e/network/network_policy.go +++ b/test/e2e/network/network_policy.go @@ -172,6 +172,185 @@ var _ = SIGDescribe("NetworkPolicy", func() { testCanConnect(f, nsB, "client-b", service, 80) }) + ginkgo.It("should enforce policy based on PodSelector with MatchExpressions[Feature:NetworkPolicy]", func() { + ginkgo.By("Creating a network policy for the server which allows traffic from the pod 'client-a'.") + policy := &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-client-a-via-pod-selector-with-match-expressions", + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{ + "pod-name": podServer.Name, + }, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{{ + From: []networkingv1.NetworkPolicyPeer{{ + PodSelector: &metav1.LabelSelector{ + MatchExpressions: []metav1.LabelSelectorRequirement{{ + Key: "pod-name", + Operator: metav1.LabelSelectorOpIn, + Values: []string{"client-a"}, + }}, + }, + }}, + }}, + }, + } + + policy, err := f.ClientSet.NetworkingV1().NetworkPolicies(f.Namespace.Name).Create(policy) + framework.ExpectNoError(err, "Error creating Network Policy %v: %v", policy.ObjectMeta.Name, err) + defer cleanupNetworkPolicy(f, policy) + + ginkgo.By("Creating client-a which should be able to contact the server.", func() { + testCanConnect(f, f.Namespace, "client-a", service, 80) + }) + ginkgo.By("Creating client-b which should not be able to contact the server.", func() { + testCannotConnect(f, f.Namespace, "client-b", service, 80) + }) + }) + + ginkgo.It("should enforce policy based on NamespaceSelector with MatchExpressions[Feature:NetworkPolicy]", func() { + nsA := f.Namespace + nsBName := f.BaseName + "-b" + nsB, err := f.CreateNamespace(nsBName, map[string]string{ + "ns-name": nsBName, + }) + framework.ExpectNoError(err, "Error creating namespace %v: %v", nsBName, err) + + nsCName := f.BaseName + "-c" + nsC, err := f.CreateNamespace(nsCName, map[string]string{ + "ns-name": nsCName, + }) + framework.ExpectNoError(err, "Error creating namespace %v: %v", nsCName, err) + + // Create Policy for the server that allows traffic from namespace different than namespace-a + ginkgo.By("Creating a network policy for the server which allows traffic from ns different than namespace-a.") + policy := &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-any-ns-different-than-ns-a-via-ns-selector-with-match-expressions", + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{ + "pod-name": podServer.Name, + }, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{{ + From: []networkingv1.NetworkPolicyPeer{{ + NamespaceSelector: &metav1.LabelSelector{ + MatchExpressions: []metav1.LabelSelectorRequirement{{ + Key: "ns-name", + Operator: metav1.LabelSelectorOpNotIn, + Values: []string{nsCName}, + }}, + }, + }}, + }}, + }, + } + + policy, err = f.ClientSet.NetworkingV1().NetworkPolicies(nsA.Name).Create(policy) + framework.ExpectNoError(err, "Error creating Network Policy %v: %v", policy.ObjectMeta.Name, err) + defer cleanupNetworkPolicy(f, policy) + + testCannotConnect(f, nsC, "client-a", service, 80) + testCanConnect(f, nsB, "client-a", service, 80) + }) + + ginkgo.It("should enforce policy based on PodSelector or NamespaceSelector [Feature:NetworkPolicy]", func() { + nsA := f.Namespace + nsBName := f.BaseName + "-b" + nsB, err := f.CreateNamespace(nsBName, map[string]string{ + "ns-name": nsBName, + }) + framework.ExpectNoError(err, "Error creating namespace %v: %v", nsBName, err) + + // Create Policy for the server that allows traffic only via client B or namespace B + ginkgo.By("Creating a network policy for the server which allows traffic from client-b or namespace-b.") + policy := &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-ns-b-via-namespace-selector-or-client-b-via-pod-selector", + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{ + "pod-name": podServer.Name, + }, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{{ + From: []networkingv1.NetworkPolicyPeer{{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "pod-name": "client-b", + }, + }, + }, { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "ns-name": nsBName, + }, + }, + }}, + }}, + }, + } + + policy, err = f.ClientSet.NetworkingV1().NetworkPolicies(nsA.Name).Create(policy) + framework.ExpectNoError(err, "Error creating Network Policy %v: %v", policy.ObjectMeta.Name, err) + defer cleanupNetworkPolicy(f, policy) + + testCanConnect(f, nsB, "client-a", service, 80) + testCanConnect(f, nsA, "client-b", service, 80) + testCannotConnect(f, nsA, "client-c", service, 80) + }) + + ginkgo.It("should enforce policy based on PodSelector and NamespaceSelector [Feature:NetworkPolicy]", func() { + nsA := f.Namespace + nsBName := f.BaseName + "-b" + nsB, err := f.CreateNamespace(nsBName, map[string]string{ + "ns-name": nsBName, + }) + framework.ExpectNoError(err, "Error creating namespace %v: %v", nsBName, err) + + // Create Policy for the server that allows traffic only via client-b in namespace B + ginkgo.By("Creating a network policy for the server which allows traffic from client-b in namespace-b.") + policy := &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "allow-client-b-in-ns-b-via-ns-selector-and-pod-selector", + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{ + "pod-name": podServer.Name, + }, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{{ + From: []networkingv1.NetworkPolicyPeer{{ + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "pod-name": "client-b", + }, + }, + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "ns-name": nsBName, + }, + }, + }}, + }}, + }, + } + + policy, err = f.ClientSet.NetworkingV1().NetworkPolicies(nsA.Name).Create(policy) + framework.ExpectNoError(err, "Error creating Network Policy %v: %v", policy.ObjectMeta.Name, err) + defer cleanupNetworkPolicy(f, policy) + + testCannotConnect(f, nsB, "client-a", service, 80) + testCannotConnect(f, nsA, "client-b", service, 80) + testCanConnect(f, nsB, "client-b", service, 80) + }) + ginkgo.It("should enforce policy based on Ports [Feature:NetworkPolicy]", func() { ginkgo.By("Creating a network policy for the Service which allows traffic only to one port.") policy := &networkingv1.NetworkPolicy{